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CLAIMS 

1. A method of arranging data protection in a telecommunication 
system comprising a first mobile communication network wherein a first cipher 
key is used for ciphering traffic between a mobile station and a. mobile eom- 

5 munication network, a second mobile communication network wherein a sec- 
ond cipher key is used for ciphering traffic between a mobile station and a mo- 
bile communication network, and a mobile station supporting said mobile 
communication networks, characterized by 

calculating said second cipher key in the first mobile communication 
10 network when the mobile station operates in the first "mobile communication 
network, 

transmitting information necessary for calculating said second ci- 
pher key from the first mobile communication network to the mobile station 
when the mobile station operates in the first mobile communication network, 
15 and 

calculating said second cipher key at the mobile station. 

2. A method as claimed in claim 1, characterized by 

using said second cipher key for ciphering the traffic between the 
mobile station and the second mobile communication network if the mobile 
20 station is handed over from the first mobile communication network to the sec- 
ond mobile communication network during an active connection. 

3. A method as claimed in claim 1 or 2, characterized by 
transmitting said second cipher key from the first mobile communi- 
cation network to the second mobile communication network, 

25 transmitting said second cipher key calculated at the mobile station 

to a ciphering means of the mobile station in response to the fact that the first 
mobile communication network transmits a request to the mobile station for 
handover to the second mobile communication network, and 

using said second cipher key in ciphering traffic after the handover 

30 in the mobile station and in the second mobile communication network. 

4. A method as claimed in any one of the preceding claims, 
characterized by 

checking, in the first mobile communication network, whether the 
mobile station supports the second mobile communication network, 
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calculating said second cipher key in the first mobile communication 
network in response to the fact that the mobile station supports the second 
mobile communication network, 

transmitting a request for calculation of said second cipher key from 
5 the first mobile communication network to the mobile station, and 

calculating at the mobile station said second cipher key in response 

to said request. 

5. A method as claimed in claim 4, characterized by 
calculating said second cipher key in the first mobile communication 

10 network in response to the fact that an identifier transmitted by the mobile sta- 
tion, such as an IMSI subscriber identifier, and/or a classmark identifier indi- 
cate that the mobile station supports the second mobile communication net- 
work. 

6. A method as claimed in any one of the preceding claims, 
15 characterized by 

calculating said second cipher key at a network element in the first 
mobile communication network, such as an authentication centre, in response 
to the fact that a network element of the first mobile communication network, 
such as a visitor location register or a home location register, comprising iden- 
20 tifiers transmitted by the mobile station requests calculation of said second ci- 
pher key, and 

transmitting said second cipher key from said network element cal- 
culating the cipher key to said network element comprising the identifiers 
transmitted by the mobile station. 
25 7. A method as claimed in any one of the preceding claims, 

characterized by 

the mobile station comprising a subscriber identification application, 
such as a USIM application, to the first mobile communication network and a 
subscriber identification application, such as an SIM application, to the second 
30 mobile communication network, 

transmitting the information necessary for calculating said second 
cipher key received by the mobile station to the identification application ac- 
cording to the second mobile communication network. 

8. A method as claimed in any one of the preceding claims, 
35 characterized by 
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calculating said second cipher key in the first mobile communication 
network in connection with calculating an authentication response according to 
the first mobile communication network and the first cipher key, 

transmitting the information necessary for calculating the first cipher 
key and said second cipher key, such as a random-number parameter, from 
the first mobile communication network to the mobile station, 

transmitting the necessary information at the mobile station for cal- 
culating said first and second cipher keys to the identification applications ac- 
cording to the first and the second mobile communication networks, 

calculating said second cipher key in the identification application 
according to the second mobile communication network and the authentication 
response in the identification application according to the first mobile commu- 
nication network, 

transmitting said authentication response according to the first mo- 
bile communication network from the mobile station to the first mobile commu- 
nication network, and 

acknowledging the authentication of the mobile station to be per- 
formed for the second mobile communication network in response to the fact 
that the first mobile communication network accepts the authentication re- 
sponse transmitted by the mobile station. 

9. A method as claimed in any one of claims 1 to 7, charac- 
terized by 

determining a random-number parameter and calculating the 
authentication response according to the second mobile communication net- 
work in connection with calculating said second cipher key in the first mobile 
communication network, 

transmitting a request to the mobile station for calculation of an 
authentication response according to the second mobile communication net- 
work, 

transmitting the information necessary at the mobile station for cal- 
culating said second cipher key to the identification application according to 
the second mobile communication network, 

calculating, in the identification application according to the second 
mobile communication network, the authentication response according to the 
second mobile communication network in connection with calculating said 
second cipher key, 
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transmitting the authentication response according to the second 
mobile communication network calculated at the mobile station to the first mo- 
bile communication network, and 

. checking said authentication response according to the second mo- 
5 bile communication network transmitted by the mobile station in the first mobile 
communication network. 

10. A method as claimed in any one of claims 1 to 7, charac- 
terized by 

calculating said second cipher key by shortening the first cipher key 
10 in the first mobile communication network and at the mobile station before the 
handover to the second mobile communication network takes place. 

11. A method as claimed in any one of the preceding claims, 
characterized by 

calculating said second cipher key in response to the fact that a de- 
15 cision has been made in the first mobile communication network to carry out 
ry handover to the second mobile communication network. 

12. A telecommunication system comprising at least a first mobile 
communication network arranged to use a first cipher key for ciphering traffic 
between a mobile station and a mobile communication network, a second mo- 

m 20 bile communication network arranged to use a second cipher key for ciphering 
[U traffic between a mobile station and a mobile communication network, and a 

2 mobile station arranged to support said different first and second mobile com- 

munication networks, characterized in that 

the first mobile communication network is arranged to calculate said 
25 second cipher key when the mobile station operates in the first mobile com- 
munication network, 

the first mobile communication network is arranged to transmit in- 
formation necessary for calculating said second cipher key from the first mo- 
bile communication network to the mobile station when the mobile station op- 
30 erates in the first mobile communication network, and 

the mobile station is arranged to calculate said second cipher key. 

13. A telecommunication system as claimed in claim 12, char- 
acterized in that 

the mobile station and the second mobile communication network 
35 are arranged to cipher the traffic between the mobile station and the second 
mobile communication network by using said second cipher key if the mobile 
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station is handed over from the first mobile communication network to the sec- 
ond mobile communication network during an active connection. 

14. A telecommunication system as claimed in claim 12 or 13, 
characterized in that 
5 the first mobile communication network is arranged to transmit said 

second cipher key to the second mobile communication network before the 
handover to the second mobile communication network, 

the mobile station is arranged to transmit said second cipher key 
calculated at the mobile station to a ciphering means of the mobile station in 
10 response to the fact that the first mobile communication network transmits a 
request to the mobile station for handover to the second mobile communica- 
tion network, and 

the mobile station and the second mobile communication network 
jfi are arranged to use said second cipher key in ciphering traffic after the hando- 

15 ver. 

15. A telecommunication system as claimed in any one of claims 12 
to 14, characterized in that 

M= the first mobile communication network is arranged to check 

L whether the mobile station supports the second mobile communication net- 

01 20 work on the basis of an identifier transmitted by the mobile station, such as an 
0? IMSI and/or a classmark identifier, 

P the first mobile communication network is arranged to calculate said 

M second cipher key in response to the fact that the mobile station supports the 

second mobile communication network, 
25 the first mobile communication network is arranged to transmit a re- 

quest to the mobile station for calculation of said second cipher key, and 

the mobile station is arranged to calculate said second cipher key 
on the basis of said request. 

16. A telecommunication system as claimed in. any one of claims 12 
30 to15 f characterized inthat 

a network element comprising identifiers transmitted by the mobile 
station of the first mobile communication network, such as a visitor location 
register or a home location register, is arranged to transmit the request for cal- 
culation of said second cipher key to a network element of the first mobile 
35 communication network, such as an authentication centre, 
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the network element of the first mobile communication network, 
such as the authentication centre, is arranged to calculate said second cipher 
key in response to the fact that the network element comprising the identifiers 
transmitted by the mobile station requests calculation of said second cipher 
5 key, and 

said network element calculating said second cipher key is ar- 
ranged to transmit the calculated second cipher key to said network element 
comprising the identifiers transmitted by the mobile station. 

17. A telecommunication system as claimed in any one of claims 1 2 
10 to 16, characterized in that 

the first mobile communication network is arranged to calculate said 
second cipher key in connection with calculation of an authentication response 
according.to the first mobile communication network and the first cipher key, 

the first mobile communication network is arranged to transmit to 
1 5 the mobile station information necessary for calculating the first cipher key and 
said second cipher key, such as a random-number parameter, 

the mobile station comprises an identification application according 
to the first mobile communication network, such as a USIM application, and an 
identification application according to the second mobile communication net- 
20 work, such as an SIM application, 

the mobile station is arranged to transmit said information neces- 
sary for calculating the first cipher key and said second cipher key to the iden- 
tification applications according to the first and the second mobile communica- 
tion networks, 

25 said identification application according to the second mobile com- 

munication network is arranged to calculate said second cipher key and said 
identification application according to the first mobile communication network 
is arranged to calculate the authentication response according to the first mo- 
bile communication network, and 

30 the mobile station is arranged to transmit the authentication re- 

sponse according to the first mobile communication network to the first mobile 
communication network. 

18. A telecommunication system as claimed in any one of claims 12 

to 16, characterized in that 
35 the first mobile communication network is arranged to determine a 

random-number parameter according to the second mobile communication 
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network and to calculate the authentication response in connection with "cal- 
culating said second cipher key, 

the first mobile communication network is arranged to transmit a re- 
quest to the mobile station for calculating the authentication response accord- 
ing to the second mobile communication network, 

the mobile station comprises an identification application according 
to the first mobile communication network, such as a USIM application, and an 
identification application according to the second mobile communication net- 
work, such as an SIM application, 

the mobile station is arranged to transmit the information necessary 
for calculating said second cipher key to the identification application accord- 
ing to the second mobile communication network, 

the identification application according to the second mobile com- 
munication network is arranged to calculate said second cipher key and the 
authentication response according to the second mobile communication net- 
work substantially simultaneously, 

the mobile station is arranged to transmit the authentication re- 
sponse according to the second mobile communication network to the first 
mobile communication network, and 

the second mobile communication network is arranged to check the 
authentication response according to the second mobile communication net- 
work. 



